diff --git a/advisories/unreviewed/2023/09/GHSA-g6rx-2w84-xmgj/GHSA-g6rx-2w84-xmgj.json b/advisories/github-reviewed/2023/09/GHSA-g6rx-2w84-xmgj/GHSA-g6rx-2w84-xmgj.json similarity index 58% rename from advisories/unreviewed/2023/09/GHSA-g6rx-2w84-xmgj/GHSA-g6rx-2w84-xmgj.json rename to advisories/github-reviewed/2023/09/GHSA-g6rx-2w84-xmgj/GHSA-g6rx-2w84-xmgj.json index 8d06259a6f7..c682d29f31e 100644 --- a/advisories/unreviewed/2023/09/GHSA-g6rx-2w84-xmgj/GHSA-g6rx-2w84-xmgj.json +++ b/advisories/github-reviewed/2023/09/GHSA-g6rx-2w84-xmgj/GHSA-g6rx-2w84-xmgj.json @@ -1,17 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-g6rx-2w84-xmgj", - "modified": "2023-09-06T15:30:26Z", + "modified": "2024-01-30T23:00:57Z", "published": "2023-09-06T15:30:26Z", "aliases": [ "CVE-2023-41946" ], + "summary": "CSRF vulnerability in Jenkins Frugal Testing Plugin", "details": "A cross-site request forgery (CSRF) vulnerability in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers to connect to Frugal Testing using attacker-specified credentials, and to retrieve test IDs and names from Frugal Testing, if a valid credential corresponds to the attacker-specified username.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "io.jenkins.plugins:frugal-testing" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.1" + } + ] + } + ] + } ], "references": [ { @@ -29,11 +51,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-352" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T23:00:57Z", "nvd_published_at": "2023-09-06T13:15:11Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2023/09/GHSA-qf42-f5vf-6w99/GHSA-qf42-f5vf-6w99.json b/advisories/github-reviewed/2023/09/GHSA-qf42-f5vf-6w99/GHSA-qf42-f5vf-6w99.json similarity index 57% rename from advisories/unreviewed/2023/09/GHSA-qf42-f5vf-6w99/GHSA-qf42-f5vf-6w99.json rename to advisories/github-reviewed/2023/09/GHSA-qf42-f5vf-6w99/GHSA-qf42-f5vf-6w99.json index 593f1d81306..bdfbd2be72b 100644 --- a/advisories/unreviewed/2023/09/GHSA-qf42-f5vf-6w99/GHSA-qf42-f5vf-6w99.json +++ b/advisories/github-reviewed/2023/09/GHSA-qf42-f5vf-6w99/GHSA-qf42-f5vf-6w99.json @@ -1,17 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-qf42-f5vf-6w99", - "modified": "2023-09-06T15:30:26Z", + "modified": "2024-01-30T23:01:31Z", "published": "2023-09-06T15:30:26Z", "aliases": [ "CVE-2023-41945" ], + "summary": "Disabled permissions granted by Jenkins Assembla Auth Plugin", "details": "Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permissions to be granted Overall/Manage and Overall/SystemRead permissions, even if those permissions are disabled and should not be granted.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:assembla-auth" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.14" + } + ] + } + ] + } ], "references": [ { @@ -29,11 +51,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-862" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T23:01:31Z", "nvd_published_at": "2023-09-06T13:15:11Z" } } \ No newline at end of file